I have a server with three custom processes running under a single domain account.
A security "expert" has recommended that three accounts be created, and each one should run under a separate account.
How is that more secure?
1
-
I found a pretty good answer here: dba.stackexchange.com/questions/72858/…– Greg GumCommented May 9, 2018 at 15:59
Add a comment
|
2 Answers
If you have one account for 3 services this means that if one of the services have a security issue and an attacker can get in, he will access to the other services files for example. By having different accounts, you reduce the impact of this effect. This depends on your case but if you have 3 services such as HTTP, DNS and an LDAP is a good idea to have different accounts for them in general.
Another alternative would be to containerize the services so they don't have host OS access, if security is the goal here.
Separating services by account is not bad, but if someone can compromise one service in such a way that they would otherwise be able to interact with another service running under the same user context, they may be able to elevate privileges to system/root and then interact with the other services anyways.
Containerizing the services removes that escalation path much more easily than other, service-specific controls do.
